![](/screenshots/ba5ab3b3-0b5b-459e-9895-7ccd00badfba.png)
www.saprealtime.com
Open in
urlscan Pro
95.217.42.4
Malicious Activity!
Public Scan
Submission: On May 04 via manual from GB
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 26th 2020. Valid for: 3 months.
This is the only time www.saprealtime.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tesco Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
14 | 95.217.42.4 95.217.42.4 | 24940 (HETZNER-AS) (HETZNER-AS) | |
5 | 18.195.42.228 18.195.42.228 | 16509 (AMAZON-02) (AMAZON-02) | |
19 | 3 |
ASN24940 (HETZNER-AS, DE)
PTR: static.4.42.217.95.clients.your-server.de
www.saprealtime.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
nexus.ensighten.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
saprealtime.com
www.saprealtime.com |
256 KB |
5 |
ensighten.com
nexus.ensighten.com |
48 KB |
19 | 2 |
Domain | Requested by | |
---|---|---|
14 | www.saprealtime.com |
www.saprealtime.com
|
5 | nexus.ensighten.com |
www.saprealtime.com
|
19 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
saprealtime.com cPanel, Inc. Certification Authority |
2020-02-26 - 2020-05-26 |
3 months | crt.sh |
nexus.ensighten.com DigiCert SHA2 Secure Server CA |
2019-10-03 - 2020-10-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.saprealtime.com/b25/sc0/adapter2adapter.ping.html?SDAN=MSs22djpHh2DSWF5LcCk6zGJIvbAAMkADcyMWNlOGU4LTA1MTctNGU5NC04NmVhLTM2ZjY2MWQ1ODUyZQAuAAAAAACPL3Vd8cnLS4%2FrNHDvh%2BurAQDLxtTRqKyYQrNPEBhBv0F3AAAMdHa7AAA_938945743421MTctNGU5NC04NmVhLTM2ZjY2MW1MTctNGU5NC04NmVhLTM2ZjY2MW
Frame ID: 37218F94F04A8A51A9FBF785118CD74F
Requests: 20 HTTP requests in this frame
Screenshot
![](/screenshots/ba5ab3b3-0b5b-459e-9895-7ccd00badfba.png)
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
![](/vendor/wappa/icons/ensighten.png)
Detected patterns
- script /\/\/nexus\.ensighten\.com\//i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
adapter2adapter.ping.html
www.saprealtime.com/b25/sc0/ |
17 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core-standalone.min.css
www.saprealtime.com/b25/sc0/files/ |
111 KB 111 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core-head.min.js
www.saprealtime.com/b25/sc0/files/ |
5 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Bootstrap.js
www.saprealtime.com/b25/sc0/files/ |
122 KB 123 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core.min.js
www.saprealtime.com/b25/sc0/fils/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Bootstrap.js
nexus.ensighten.com/tescobank/privacy/ |
170 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
serverComponent.php
nexus.ensighten.com/tescobank/brochureware/ |
480 B 622 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e.gif
nexus.ensighten.com/error/ |
0 106 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
TESCOModern-Regular-web.woff2
www.saprealtime.com/b25/sc0/font/TescoModern/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
309 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
TESCOModern-Light-web.woff2
www.saprealtime.com/b25/sc0/font/TescoModern/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
TESCOModern-Bold-web.woff2
www.saprealtime.com/b25/sc0/font/TescoModern/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
TESCOModern-Medium-web.woff2
www.saprealtime.com/b25/sc0/font/TescoModern/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3937a5c9251b77351bfbf114b449cbe5.js
nexus.ensighten.com/tescobank/brochureware/code/ |
8 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bf24749f05f98389d148459b60206b5d.js
nexus.ensighten.com/tescobank/brochureware/code/ |
7 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core.min.js
www.saprealtime.com/b25/sc0/fils/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
TESCOModern-Regular-web.woff
www.saprealtime.com/b25/sc0/font/TescoModern/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
TESCOModern-Bold-web.woff
www.saprealtime.com/b25/sc0/font/TescoModern/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
TESCOModern-Medium-web.woff
www.saprealtime.com/b25/sc0/font/TescoModern/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
TESCOModern-Light-web.woff
www.saprealtime.com/b25/sc0/font/TescoModern/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tesco Bank (Banking)20 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| Modernizr object| ensBootstraps object| Bootstrapper function| $data function| $getData number| _delay function| _log object| _enslog string| key string| k object| ensPrivacyBootstrap string| alwaysServePrivacy object| ensClientConfig object| ensLogger boolean| ensBrowserSupported object| cookieManager function| PLX1 function| injectPrivacyModal0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
nexus.ensighten.com
www.saprealtime.com
18.195.42.228
95.217.42.4
0b18d5fe8d980d62a9e5e1f2334f37065cd759bb991249753ace5482f0d5713c
1dd88c1b04ca599e174b2b0f463063a0a499a8d8d08a11a8b1fdf72b79bf6d3e
2d4edd489f48c318551dd2a1249b039badcf51610d3b25e9bbc4a72ff35c34d8
52b83548ee999b26668f060d8f047a242ada9b0a3f94805c3ffb0a9759516536
b8119b532c5a3431c3028ec3a60b14b1d25bda7917e8868224e1db1376af053b
c2804eae78d3b87e4db649ded2e862499273c37d322661e9d391a111bb9797d0
cd3de1e24553013f7dd10f06194d8984462367456ad3bd31cf7c4604ba6935a1
db7148c7e708aa91a7d7952fbba62cdb721b2a7916a8198f3c109a1efadc8aa7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f340e61a61bf4099b1a88178341c73c33b8bfd8e5a714f21abaf6d9926522e11